2016-09-18 06:38:31

by Jason Zaman

Subject: [refpolicy] [PATCH] selinuxutil: allow setfiles to read semanage store

commit a7334eb0de98af11ec38b6263536fa01bc2a606c
libsemanage: validate and compile file contexts before installing

validates the fcontexts when they are still in /var/lib/selinux. Without
setfiles_t having access to read the files, validation fails and the
policy cannot be updated.
---
policy/modules/system/selinuxutil.if | 23 +++++++++++++++++++++++
policy/modules/system/selinuxutil.te | 1 +
2 files changed, 24 insertions(+)

diff --git a/policy/modules/system/selinuxutil.if b/policy/modules/system/selinuxutil.if
index 55d2429..665fe76 100644
--- a/policy/modules/system/selinuxutil.if
+++ b/policy/modules/system/selinuxutil.if
@@ -1101,6 +1101,29 @@ interface(`seutil_run_semanage',`

########################################
## <summary>
+## Read the semanage module store.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`seutil_read_module_store',`
+ gen_require(`
+ type selinux_config_t, semanage_store_t;
+ ')
+
+ files_search_etc($1)
+ files_search_var($1)
+ list_dirs_pattern($1, selinux_config_t, semanage_store_t)
+ list_dirs_pattern($1, semanage_store_t, semanage_store_t)
+ read_files_pattern($1, semanage_store_t, semanage_store_t)
+ read_lnk_files_pattern($1, semanage_store_t, semanage_store_t)
+')
+
+########################################
+## <summary>
## Full management of the semanage
## module store.
## </summary>
diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
index f98e382..3285287 100644
--- a/policy/modules/system/selinuxutil.te
+++ b/policy/modules/system/selinuxutil.te
@@ -589,6 +589,7 @@ logging_send_syslog_msg(setfiles_t)
miscfiles_read_localization(setfiles_t)

seutil_libselinux_linked(setfiles_t)
+seutil_read_module_store(setfiles_t)

userdom_use_all_users_fds(setfiles_t)
# for config files in a home directory
--
2.7.3

2016-09-18 20:47:50

by Chris PeBenito

Subject: [refpolicy] [PATCH] selinuxutil: allow setfiles to read semanage store

On 09/18/16 02:38, Jason Zaman via refpolicy wrote:
> commit a7334eb0de98af11ec38b6263536fa01bc2a606c
> libsemanage: validate and compile file contexts before installing
>
> validates the fcontexts when they are still in /var/lib/selinux. Without
> setfiles_t having access to read the files, validation fails and the
> policy cannot be updated.
> ---
> policy/modules/system/selinuxutil.if | 23 +++++++++++++++++++++++
> policy/modules/system/selinuxutil.te | 1 +
> 2 files changed, 24 insertions(+)
>
> diff --git a/policy/modules/system/selinuxutil.if b/policy/modules/system/selinuxutil.if
> index 55d2429..665fe76 100644
> --- a/policy/modules/system/selinuxutil.if
> +++ b/policy/modules/system/selinuxutil.if
> @@ -1101,6 +1101,29 @@ interface(`seutil_run_semanage',`
>
> ########################################
> ## <summary>
> +## Read the semanage module store.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`seutil_read_module_store',`
> + gen_require(`
> + type selinux_config_t, semanage_store_t;
> + ')
> +
> + files_search_etc($1)
> + files_search_var($1)
> + list_dirs_pattern($1, selinux_config_t, semanage_store_t)
> + list_dirs_pattern($1, semanage_store_t, semanage_store_t)
> + read_files_pattern($1, semanage_store_t, semanage_store_t)
> + read_lnk_files_pattern($1, semanage_store_t, semanage_store_t)
> +')
> +
> +########################################
> +## <summary>
> ## Full management of the semanage
> ## module store.
> ## </summary>
> diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
> index f98e382..3285287 100644
> --- a/policy/modules/system/selinuxutil.te
> +++ b/policy/modules/system/selinuxutil.te
> @@ -589,6 +589,7 @@ logging_send_syslog_msg(setfiles_t)
> miscfiles_read_localization(setfiles_t)
>
> seutil_libselinux_linked(setfiles_t)
> +seutil_read_module_store(setfiles_t)
>
> userdom_use_all_users_fds(setfiles_t)
> # for config files in a home directory


Merged.


--
Chris PeBenito